CVE-2025-30090 | High | 7.2 | 2025-04-02 | mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishan… |
CVE-2020-14933 | High | 8.8 | 2020-06-20 | compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this bec… |
CVE-2020-14932 | Critical | 9.8 | 2020-06-20 | compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php. |
CVE-2012-5623 | High | 7.5 | 2020-02-13 | Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords. |
CVE-2019-12970 | Medium | 6.1 | 2019-07-01 | XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitizat… |
CVE-2018-14955 | Medium | 6.1 | 2018-08-05 | The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute). |
CVE-2018-14954 | Medium | 6.1 | 2018-08-05 | The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute. |
CVE-2018-14953 | Medium | 6.1 | 2018-08-05 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack. |
CVE-2018-14952 | Medium | 6.1 | 2018-08-05 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack. |
CVE-2018-14951 | Medium | 6.1 | 2018-08-05 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack. |
CVE-2018-14950 | Medium | 6.1 | 2018-08-05 | The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack. |
CVE-2018-8741 | High | 8.8 | 2018-03-17 | A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the hosting server, related… |
CVE-2017-7692 | High | 8.8 | 2017-04-20 | SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in… |
CVE-2012-2124 | | | 2013-01-18 | functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise Linux (RHEL) 4 and 5, does not properly handle 8-bit characters in passwords, which a… |
CVE-2012-0323 | | | 2012-03-09 | Cross-site scripting (XSS) vulnerability in the Autocomplete plugin before 3.0 for SquirrelMail allows remote attackers to inject arbitrary web script or HTML… |
CVE-2011-2753 | | | 2011-07-17 | Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecifie… |
CVE-2011-2752 | | | 2011-07-17 | CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a diff… |
CVE-2011-2023 | | | 2011-07-14 | Cross-site scripting (XSS) vulnerability in functions/mime.php in SquirrelMail before 1.4.22 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2010-4555 | | | 2011-07-14 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to inject arbitrary web script or HTML via vector… |
CVE-2010-4554 | | | 2011-07-14 | functions/page_header.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easi… |
CVE-2010-2813 | | | 2010-08-19 | functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denia… |
CVE-2010-1637 | Medium | 6.5 | 2010-06-22 | The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to s… |
CVE-2009-2964 | | | 2009-08-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the aut… |
CVE-2009-1381 | | | 2009-05-22 | The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions… |
CVE-2009-1581 | | | 2009-05-14 | functions/mime.php in SquirrelMail before 1.4.18 does not protect the application's content from Cascading Style Sheets (CSS) positioning in HTML e-mail messag… |
CVE-2009-1580 | | | 2009-05-14 | Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie. |
CVE-2009-1579 | | | 2009-05-14 | The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.18 and NaSMail before 1.7 allows remote attackers to execute arbitrary comma… |
CVE-2009-1578 | | | 2009-05-14 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script… |
CVE-2009-0030 | | | 2009-01-21 | A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other u… |
CVE-2008-2379 | | | 2008-12-05 | Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink i… |
CVE-2008-3663 | | | 2008-09-24 | Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it… |
CVE-2007-6348 | | | 2007-12-14 | SquirrelMail 1.4.11 and 1.4.12, as distributed on sourceforge.net before 20071213, has been externally modified to create a Trojan Horse that introduces a PHP… |
CVE-2007-3779 | | | 2007-07-15 | PHP local file inclusion vulnerability in gpg_pop_init.php in the G/PGP (GPG) Plugin before 20070707 for Squirrelmail allows remote attackers to include and ex… |
CVE-2007-3778 | | | 2007-07-15 | The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the… |
CVE-2006-4169 | | | 2007-07-15 | Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated users to in… |
CVE-2007-3636 | | | 2007-07-10 | Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecified vector… |
CVE-2007-3635 | | | 2007-07-10 | Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin before 2.1 for Squirrelmail might allow "local authenticated users" to inject certain commands v… |
CVE-2007-3634 | | | 2007-07-10 | Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecifie… |
CVE-2007-2631 | | | 2007-05-13 | Cross-site request forgery (CSRF) vulnerability in SquirrelMail 1.4.8-4.fc6 and earlier allows remote attackers to perform unspecified actions as arbitrary use… |
CVE-2007-2589 | | | 2007-05-11 | Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary user… |
CVE-2007-1262 | | | 2007-05-11 | Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web scri… |
CVE-2006-6142 | | | 2006-12-05 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (… |
CVE-2006-4019 | | | 2006-08-11 | Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and re… |
CVE-2006-3665 | | | 2006-07-18 | SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while… |
CVE-2006-3174 | | | 2006-06-23 | Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject a… |
CVE-2006-2842 | | | 2006-06-06 | PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disab… |
CVE-2006-0377 | | | 2006-02-24 | CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox par… |
CVE-2006-0195 | | | 2006-02-24 | Interpretation conflict in the MagicHTML filter in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via style… |
CVE-2006-0188 | | | 2006-02-24 | webmail.php in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary web pages into the right frame via a URL in the right_frame parameter… |
CVE-2005-1924 | | | 2005-12-31 | The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr… |
CVE-2005-3128 | | | 2005-10-04 | Cross-site scripting (XSS) vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arbitrary web script o… |
CVE-2005-2095 | | | 2005-07-13 | options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or r… |
CVE-2005-1769 | | | 2005-06-16 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unkno… |
CVE-2005-0239 | | | 2005-05-02 | viewcert.php in the S/MIME plugin 0.4 and 0.5 for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the cert param… |
CVE-2005-0184 | | | 2005-05-02 | Directory traversal vulnerability in ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to read arbitrary files via a .. (dot… |
CVE-2005-0183 | | | 2005-05-02 | ftpfile in the Vacation plugin 0.15 and earlier for Squirrelmail allows local users to execute arbitrary commands via shell metacharacters in a command line ar… |
CVE-2004-1036 | | | 2005-03-01 | Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs befo… |
CVE-2005-0152 | | | 2005-02-02 | PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation." |
CVE-2005-0104 | | | 2005-01-29 | Cross-site scripting (XSS) vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via certain… |
CVE-2005-0075 | | | 2005-01-29 | prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom prefe… |
CVE-2005-0103 | | | 2005-01-24 | PHP remote file inclusion vulnerability in webmail.php in SquirrelMail before 1.4.4 allows remote attackers to execute arbitrary PHP code by modifying a URL pa… |
CVE-2004-0521 | | | 2004-08-18 | SQL injection vulnerability in SquirrelMail before 1.4.3 RC1 allows remote attackers to execute unauthorized SQL statements, with unknown impact, probably via… |
CVE-2004-0520 | | | 2004-08-18 | Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the content-… |
CVE-2004-0519 | | | 2004-08-18 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possibly steal… |
CVE-2004-0639 | | | 2004-08-06 | Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $m… |
CVE-2003-0990 | | | 2004-01-20 | The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To:" field. |
CVE-2003-0160 | | | 2003-04-02 | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.2.11 allow remote attackers to inject arbitrary HTML code and steal information fr… |
CVE-2002-2086 | | | 2002-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in magicHTML of SquirrelMail before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via… |
CVE-2002-1650 | | | 2002-12-31 | The spell checker plugin (check_me.mod.php) for SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary commands via a modified sqspell_command… |
CVE-2002-1649 | | | 2002-12-31 | Cross-site scripting (XSS) vulnerability in read_body.php in SquirrelMail before 1.2.3 allows remote attackers to execute arbitrary Javascript via a javascript… |
CVE-2002-1648 | | | 2002-12-31 | Cross-site request forgery (CSRF) vulnerability in compose.php in SquirrelMail before 1.2.3 allows remote attackers to send email as other users via an IMG URL… |
CVE-2002-1341 | | | 2002-12-18 | Cross-site scripting (XSS) vulnerability in read_body.php for SquirrelMail 1.2.10, 1.2.9, and earlier allows remote attackers to insert script and HTML via the… |
CVE-2002-1276 | | | 2002-11-29 | An incomplete fix for a cross-site scripting (XSS) vulnerability in SquirrelMail 1.2.8 calls the strip_tags function on the PHP_SELF value but does not save th… |
CVE-2002-1132 | | | 2002-10-04 | SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage file argument, whic… |
CVE-2002-1131 | | | 2002-10-04 | Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressbook.php, (2… |
CVE-2002-0516 | | | 2002-08-12 | SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie. |
CVE-2001-1159 | | | 2001-07-02 | load_prefs.php and supporting include files in SquirrelMail 1.0.4 and earlier do not properly initialize certain PHP variables, which allows remote attackers t… |